That's because you're using `mov rdi, rax` again. You keep changing `edi, eax` to `rdi, rax`. Why?
The default operand size in 64-bit mode is, for most instructions, still 32 bits. So `mov edi, eax` encodes the same in 32- and 64-bit mode.
For `mov rdi, rax` you need an extra REX prefix byte [1], that's the 48 you're seeing above, but you don't need it here.
[1] https://wiki.osdev.org/X86-64_Instruction_Encoding#REX_prefi...
okay, I didn't know that, thanks for the background.
I wonder why the assembler would not optimize this though.
I noticed that I then could also shave of one byte more by using lea esi, [rel msg] instead of lea rsi, [rel msg].
But even if it was 32 bit, then we would't have to copy a 1, since the syscall number for sys_write would be 4 instead of 1.
I get the same total size with both variants in 64 bit mode.
Assembling to 48 89 C7 (3 bytes)seems to be same in size as
Assembling to 6A 01 5F (3 bytes)